@codyswann/lisa 4.39.0 → 4.40.1

package/all/copy-overwrite/scripts/lisa-cross-worktree-guard.mjs

@@ -0,0 +1,333 @@
+#!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+/**
+ * Refuse a commit that stages a NEW file byte-identical to uncommitted work
+ * living in a different linked worktree.
+ *
+ * WHAT THIS IS FOR. When several agents share one repository through linked
+ * worktrees, one agent's uncommitted file can be committed by another — the
+ * file is real, the branch is real, the commit succeeds, every gate passes,
+ * and the history is quietly wrong about who did what. One confirmed case:
+ * a 284-line test file staged in one worktree was committed an hour later
+ * from elsewhere, byte-identical, under a subtly different subject line.
+ *
+ * WHY IT MUST BE A HOOK AND NOT A HABIT. The failure mode is that nobody
+ * notices. A check an agent has to remember to run is a check that does not
+ * run on the commit where it mattered. This runs on every commit, needs no
+ * cooperation, and costs one `stat` per linked worktree per newly added file.
+ *
+ * WHY CONTENT AND NOT MESSAGE. The observed case had a rewritten subject
+ * line, so anything keyed on the message would have missed it. Blob identity
+ * cannot be edited away.
+ *
+ * THE LIMIT, STATED PLAINLY. This needs BOTH halves — the file being staged
+ * here and the original still present over there. Once the other worktree is
+ * removed, the comparison has nothing to match against and this guard is
+ * silent. A clean run is therefore not proof that no work was taken; it is
+ * proof that none is takeable *right now*. Deleting a worktree that holds
+ * uncommitted work permanently forecloses the only window in which its own
+ * case was detectable.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Paths that are ambient session furniture rather than authored work.
+ *
+ * Matched with `startsWith` rather than a constructed RegExp: a literal prefix
+ * needs no pattern, and building one invites escaping that the shipped fixer
+ * then rewrites, which makes this file stop being a fixed point of Lisa's own
+ * formatter (#2788).
+ */
+const IGNORED_PREFIXES = [".codex/"];
+
+/**
+ * Content below this many bytes is not evidence of anything. A short or empty
+ * file collides across worktrees by coincidence — an empty `__init__`, a
+ * one-line barrel re-export, a placeholder — and a guard that fires on those
+ * teaches people to bypass it, which costs more than the cases it would catch.
+ */
+const MIN_INTERESTING_BYTES = 64;
+
+/**
+ * Header markers that identify a file as GENERATED rather than authored.
+ *
+ * Two agents running the same deterministic generator against the same source
+ * produce byte-identical output, in different worktrees, that is not yet on the
+ * integration branch. That is this guard's trigger condition exactly — and it
+ * is legitimate concurrent work rather than one agent taking another's.
+ *
+ * Measured against the real repository with two worktrees and the real
+ * generators: for an artifact that already EXISTS on the integration branch the
+ * case is excluded twice over — a regenerated file stages as a modification,
+ * not an addition, and it is tracked in the other worktree. Disabling either
+ * clause alone still accepted; only disabling BOTH made it refuse, which is how
+ * that redundancy was established rather than assumed.
+ *
+ * A generator that emits a file NOT yet on the integration branch has neither
+ * protection: it stages as an addition here and sits untracked over there. That
+ * case was reproduced and DID refuse, so this marker check is what closes it.
+ *
+ * Keyed on the file's own declaration rather than on a path list, because the
+ * distinction that matters is "identical because both were generated from the
+ * same source" versus "identical because it is the same authored file" — and a
+ * generated file says so at the top. A path list would need updating every time
+ * a generator learns a new output, and would be wrong silently until it was.
+ */
+const GENERATED_MARKERS = Object.freeze([
+  "@generated",
+  "Generated by",
+  "DO NOT EDIT",
+  "Do not edit",
+  "managed by Lisa",
+]);
+
+/**
+ * How far into a file the declaration must appear.
+ *
+ * A generated file announces itself in its header. Scanning the whole file
+ * would let the words "do not edit" occurring in ordinary prose — a rule, a
+ * skill, a comment quoting a banner — silence the guard for an authored file.
+ */
+const GENERATED_HEADER_BYTES = 2048;
+
+/**
+ * Run a command, returning its trimmed stdout, or `null` when it exits
+ * non-zero. Used for probes whose failure is a legitimate answer ("this path
+ * is not on main", "this path is not tracked there") rather than an error.
+ */
+function probe(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function must(args, cwd) {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  }).trim();
+}
+
+/** Absolute paths of every registered linked worktree, this one included. */
+function worktrees(repo) {
+  const out = probe(["worktree", "list", "--porcelain"], repo) ?? "";
+  return out
+    .split("\n")
+    .filter(line => line.startsWith("worktree "))
+    .map(line => line.slice("worktree ".length).trim())
+    .filter(Boolean);
+}
+
+/**
+ * Paths staged as ADDED in this commit.
+ *
+ * Deliberately only `A`. A modified tracked file is frequently identical
+ * across worktrees for honest reasons — a regenerated manifest is the common
+ * one, and it is deterministic, so two agents regenerating it produce the same
+ * bytes while differing from main. Firing on that would make the guard noise
+ * on nearly every commit. A brand-new file with identical content in two
+ * worktrees has no such innocent explanation.
+ */
+function stagedAdditions(repo) {
+  const out = probe(
+    ["diff", "--cached", "--name-only", "--diff-filter=A", "-z"],
+    repo
+  );
+  if (out === null) return [];
+  return out.split("\0").filter(Boolean);
+}
+
+/** The blob this commit is staging for `path`, or null when unreadable. */
+function stagedBlob(repo, path) {
+  return probe(["rev-parse", `:${path}`], repo);
+}
+
+/**
+ * Whether `blob` is simply what the integration branch already holds at
+ * `path`.
+ *
+ * THIS IS THE REJECTION CONTROL, and without it the guard is worthless rather
+ * than merely weak. Measured while designing this: a first pass without it
+ * fired on four files in one worktree that were byte-identical to `origin/main`
+ * — content every worktree carries for the ordinary reason. A guard that
+ * reports shared history as contamination fires on every worktree and is
+ * switched off within the hour.
+ */
+function isIntegrationContent(repo, defaultRef, path, blob) {
+  if (!defaultRef) return false;
+  return probe(["rev-parse", `${defaultRef}:${path}`], repo) === blob;
+}
+
+/**
+ * Whether the blob's header declares it generated.
+ * @param {string} repo Repository root.
+ * @param {string} blob Blob sha to read.
+ * @returns {boolean} True when a generated marker appears in the header.
+ */
+function declaresItselfGenerated(repo, blob) {
+  const body = probe(["cat-file", "blob", blob], repo);
+  if (body === null) return false;
+  const header = body.slice(0, GENERATED_HEADER_BYTES);
+  return GENERATED_MARKERS.some(marker => header.includes(marker));
+}
+
+/** The remote-tracking integration ref, or null when it cannot be resolved. */
+function integrationRef(repo) {
+  const symref = probe(
+    ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"],
+    repo
+  );
+  if (symref) return symref.replace(/^refs\/remotes\//, "");
+  for (const candidate of ["origin/main", "origin/master"]) {
+    if (probe(["rev-parse", "--verify", "--quiet", candidate], repo))
+      return candidate;
+  }
+  return null;
+}
+
+/**
+ * Paths the operator has explicitly cleared, as a comma-separated list.
+ *
+ * Deliberately path-scoped rather than a boolean. A blanket "off" switch on a
+ * guard like this gets set once, in frustration, and never unset — and the
+ * next real case passes silently. Naming the file keeps the override as narrow
+ * as the situation that justified it.
+ */
+function clearedPaths() {
+  const raw = process.env.LISA_ALLOW_CROSS_WORKTREE_BLOB;
+  if (!raw) return new Set();
+  return new Set(
+    raw
+      .split(",")
+      .map(entry => entry.trim())
+      .filter(Boolean)
+  );
+}
+
+function findCollisions(repo, self) {
+  const additions = stagedAdditions(repo);
+  if (additions.length === 0) return [];
+
+  const others = worktrees(repo).filter(tree => tree !== self);
+  if (others.length === 0) return [];
+
+  const defaultRef = integrationRef(repo);
+  const cleared = clearedPaths();
+  const collisions = [];
+
+  for (const path of additions) {
+    if (cleared.has(path)) continue;
+    if (IGNORED_PREFIXES.some(prefix => path.startsWith(prefix))) continue;
+
+    const blob = stagedBlob(repo, path);
+    if (!blob) continue;
+
+    const size = Number(probe(["cat-file", "-s", blob], repo));
+    if (!Number.isFinite(size) || size < MIN_INTERESTING_BYTES) continue;
+
+    if (isIntegrationContent(repo, defaultRef, path, blob)) continue;
+
+    if (declaresItselfGenerated(repo, blob)) continue;
+
+    for (const tree of others) {
+      const candidate = join(tree, path);
+      // The stat is the cheap filter: almost every worktree lacks the path,
+      // so almost every pair costs one failed stat and nothing else.
+      if (!existsSync(candidate)) continue;
+      let stats;
+      try {
+        stats = statSync(candidate);
+      } catch {
+        continue;
+      }
+      if (!stats.isFile()) continue;
+
+      const theirs = probe(["hash-object", candidate], repo);
+      if (theirs !== blob) continue;
+
+      // Tracked over there means it is shared history reaching that worktree
+      // through a branch, not that agent's work in progress.
+      const tracked = probe(["-C", tree, "ls-files", "--error-unmatch", path]);
+      if (tracked !== null) continue;
+
+      collisions.push({ path, tree });
+      break;
+    }
+  }
+
+  return collisions;
+}
+
+function report(collisions) {
+  const lines = [
+    "",
+    "❌ Commit blocked: staged content is also uncommitted in another worktree.",
+    "",
+  ];
+  for (const { path, tree } of collisions) {
+    lines.push(`   ${path}`);
+    lines.push(`     byte-identical to an uncommitted copy in ${tree}`);
+  }
+  lines.push("");
+  lines.push("   Each file above is being added here while the same bytes sit");
+  lines.push(
+    "   uncommitted in another worktree. Either another agent authored it and"
+  );
+  lines.push(
+    "   this commit would take credit for work in progress, or the same work"
+  );
+  lines.push("   is about to land twice on two branches.");
+  lines.push("");
+  lines.push("   Before retrying, establish which worktree authored it:");
+  lines.push(
+    "     git log --all --oneline --find-object=$(git rev-parse :<path>)"
+  );
+  lines.push(
+    "   Inspect the other branch through shared refs — git log, git show,"
+  );
+  lines.push(
+    "   git cat-file all reach it from here. Do NOT enter another agent's"
+  );
+  lines.push(
+    "   working tree, and do not delete it: it may hold the only copy."
+  );
+  lines.push("");
+  lines.push("   If this really is your own file, clear it by name:");
+  lines.push(
+    `     LISA_ALLOW_CROSS_WORKTREE_BLOB='${collisions.map(c => c.path).join(",")}' git commit ...`
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+
+function main() {
+  let repo;
+  let self;
+  try {
+    repo = must(["rev-parse", "--show-toplevel"]);
+    self = repo;
+  } catch {
+    // Not a git repository, or git is unavailable. A commit is not happening
+    // here in any case; there is nothing for this guard to say.
+    return 0;
+  }
+
+  const collisions = findCollisions(repo, self);
+  if (collisions.length === 0) return 0;
+
+  process.stderr.write(report(collisions));
+  return 1;
+}
+
+process.exit(main());

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -1711,6 +1711,23 @@ def executed_operand(argv):
                 # ordinary shell options and do not consume the script path.
                 if not head.startswith("--") and "c" in head[1:]:
                     return None
+                # `-n` is noexec: the shell READS and parses the file and then
+                # exits without running a line of it. `bash -n <file>` is the
+                # one shape that puts a path at a command position while
+                # provably executing nothing, so it is the exact seam between
+                # reading and running — and this walk got it wrong in BOTH
+                # directions (CodySwannGT/lisa#3781). A creation-shaped file
+                # earned a false refusal; a file carrying a human-gate marker
+                # earned a false ALLOW, adjudicating as "declared" a command
+                # that filed nothing. The silent direction is the worse one.
+                #
+                # Not a read-only-command exemption: `bash <file>` still runs
+                # the file and is still refused. The distinction is noexec, not
+                # the program.
+                if head == "--noexec" or (
+                    not head.startswith("--") and "n" in head[1:]
+                ):
+                    return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -722,6 +722,20 @@ def shell_script_operand(args):
             # not a script file.
             if not token.startswith("--") and "c" in token[1:]:
                 return None
+            # `-n` is noexec: the shell READS and parses the file, then exits
+            # without executing a line of it. `bash -n <file>` is the one shape
+            # that puts a path at a command position while provably running
+            # nothing — the exact seam between reading and running, and this
+            # walk got it wrong (CodySwannGT/lisa#3781). Here that meant a
+            # syntax check of any script mentioning a managed path was refused
+            # as though it were about to write one.
+            #
+            # `bash <file>` still executes and is still refused. Noexec is the
+            # distinction, not the program.
+            if token == "--noexec" or (
+                not token.startswith("--") and "n" in token[1:]
+            ):
+                return None
             continue
         return token
     return None

package/all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh

@@ -27,6 +27,13 @@
 #      `source`, `.`, `bash < nv.sh`, and an interpreter a `find -exec` or
 #      `xargs` puts at a command position.
 #
+# NOT vector 11: `bash -n nv.sh`. `-n` is noexec — the shell reads and parses
+# the file, then exits without running a line — so a syntax check is the one
+# shape that puts a path at a command position while executing nothing. It used
+# to be refused, which made `bash -n` unusable on this file, on every husky
+# hook, and on most of this repository (#3781). The distinction is noexec, not
+# the program: `bash nv.sh` still executes and is still refused.
+#
 # The line below is what lets `lisa apply` tell a downstream copy of this guard
 # that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
 # "differs from mine", and guessing "behind" is how a fork's stronger guard gets
@@ -1034,6 +1041,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -1064,12 +1075,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1114,6 +1138,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/dist/codex/scripts/block-no-verify.sh

@@ -937,6 +937,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -967,12 +971,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1017,6 +1034,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAigCjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo6BjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA4gCjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA+6BjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -404,6 +404,12 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "5d587fd849cef02e9706d084ac2b508f3885da0ba59b76311e3b666f4fbff01e",
         "99422b4912cd660ddeb5ec5ab9fc333e57fa5763e711117a00b06dd2eda0bbb7",
     ]),
+    "scripts/lisa-cross-worktree-guard.mjs": Object.freeze([
+        "3967e4eb189c043e8702ca5cff40c4612ed77027a053e23635eeb367a436cb9d",
+        "41b92e1e94a8ee9ad0235359dbd83566a49b17db60da933835057dc77008ab87",
+        "d8625e2d339ac512350203e29e70f7b20546bf5248cf952aafd997389feb230f",
+        "e0ef99ef1df32f76601a2106a2b68b3c31a126e0b48e8b8ceaba1a7476c32900",
+    ]),
     "scripts/lisa-destructive-guard.mjs": Object.freeze([
         "4fb431a3c58f443e303d613934d023d9e95ddae5c42710bb7009f7c080c82a64",
         "66ade2c9cc0554c4934ed94a44563fd9d648b37cacfa9a5d31f17ac4f181e5a3",
@@ -602,6 +608,8 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2832037d6c8d7930a111519dee0cca0ed0110deba3988f8e713bb9203de254df",
         "2e030d5a394d3edb48c391db49661fb3d45545c85f88ea03d1ab07ad3787c089",
         "412209ea2329a64737eeffa4ffc9b6f9371f14cf86419fd0626361a99188a3f8",
+        "49fb071d5e062200b09babdc56002bc6bd8aceefd8508c49763c05d505f5083e",
+        "500b5d5770cf7a6bf5588effe6db462fe0a4646d1de3e8b799115279af1b2662",
         "5b3bd8a3460524457435f51a0994fb12009c97fffb921375bc79db3798acbabf",
         "5c5a9f1c39f99e493a575784f70379eb857c4963da5d400b6ee86f0e69fc5402",
         "60a4f94ec671b2372f7492680ab327d97aff686588ce85791f54e0fbd098b0ca",
@@ -627,6 +635,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lisa-hooks/block-managed-file-edits.sh": Object.freeze([
         "133acf329582c5d4df9deb6a297df13216993c1bfec0b7df0663c69a1e2bb0db",
         "18aebaef5ea9bf6af220dc9beef80a5cfb37282c6a53047783b4cc96d8daa4e3",
+        "2bc98db04ded8aa64af5d894f485173fbfad81976cbd0c6938de6910acfbd577",
         "387a3f7f7dfbde9823532435fc1c7dbca687c8f3d1b63d9a435812b4a33e0425",
         "3882bd338e65b9db9e97aa9e70426f0f7a0d191539df51636e1a5e93a2501137",
         "38a52af7c9d5f36e9e68553bf68a7d1ced9e9f9e6cecdf615efc122d42c8b89e",
@@ -669,6 +678,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "dd1aea1b9fdd0da023bf704b331b350bc14620f4364afa5001c6690fcbc940cc",
         "e3407d63eae16662923d46b75b6a41e7ca7ab206b428ea2cbb0b4fee226f6516",
         "e5070ad1408dcd30f1ec44d8c4b9b914a57a9930c0fc9345bd6f28941b52afe3",
+        "e987dd924dbbdc35eddf607a27372bfac6cf743c9ddb888d8a81b4b128c10908",
         "efd20725ffa4a613823084bc00f1ab584353f8d7ed1c11672b0a0193aefe658c",
     ]),
     "scripts/lisa-hooks/block-shell-json-parsing.sh": Object.freeze([
@@ -752,6 +762,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "03dda43b5813b5b6a083c1e0302ce3e9fec13818864ed38dce180cbdaa4e2de2",
         "0cd013a51a81d8eeebced9f2646bdb3fe0a9247fcd74b57c03e95cc2db3fe7de",
         "0f5d9027e95d47745827adcd979e3c2355271066b6b84d661215dc6e895b3ac2",
+        "0fe73e162ece6c4a8270b0d5d675d6927a62962e0ae9275239c6acfacd0ef6c8",
         "11bc91eb0ab1f669fc6531201f16747dc8b5bfcebb1650ad8c29038e9ec8f89e",
         "19c77dd5ff81caf3ed92b5263b662bc16f9b43308993c6450cb6611bb037b180",
         "20bc2e58a54d7ef3c99b91393b85aa2f59d42984cbcbdb0a710b2c8d12d46b39",
@@ -1422,6 +1433,12 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lisa-commit-msg-gates.mjs": Object.freeze([
         "5d587fd849cef02e9706d084ac2b508f3885da0ba59b76311e3b666f4fbff01e",
     ]),
+    "scripts/lisa-cross-worktree-guard.mjs": Object.freeze([
+        "3967e4eb189c043e8702ca5cff40c4612ed77027a053e23635eeb367a436cb9d",
+        "41b92e1e94a8ee9ad0235359dbd83566a49b17db60da933835057dc77008ab87",
+        "d8625e2d339ac512350203e29e70f7b20546bf5248cf952aafd997389feb230f",
+        "e0ef99ef1df32f76601a2106a2b68b3c31a126e0b48e8b8ceaba1a7476c32900",
+    ]),
     "scripts/lisa-destructive-guard.mjs": Object.freeze([
         "4fb431a3c58f443e303d613934d023d9e95ddae5c42710bb7009f7c080c82a64",
         "66ade2c9cc0554c4934ed94a44563fd9d648b37cacfa9a5d31f17ac4f181e5a3",
@@ -1576,6 +1593,8 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2832037d6c8d7930a111519dee0cca0ed0110deba3988f8e713bb9203de254df",
         "2e030d5a394d3edb48c391db49661fb3d45545c85f88ea03d1ab07ad3787c089",
         "412209ea2329a64737eeffa4ffc9b6f9371f14cf86419fd0626361a99188a3f8",
+        "49fb071d5e062200b09babdc56002bc6bd8aceefd8508c49763c05d505f5083e",
+        "500b5d5770cf7a6bf5588effe6db462fe0a4646d1de3e8b799115279af1b2662",
         "5b3bd8a3460524457435f51a0994fb12009c97fffb921375bc79db3798acbabf",
         "5c5a9f1c39f99e493a575784f70379eb857c4963da5d400b6ee86f0e69fc5402",
         "60a4f94ec671b2372f7492680ab327d97aff686588ce85791f54e0fbd098b0ca",
@@ -1601,6 +1620,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lisa-hooks/block-managed-file-edits.sh": Object.freeze([
         "133acf329582c5d4df9deb6a297df13216993c1bfec0b7df0663c69a1e2bb0db",
         "18aebaef5ea9bf6af220dc9beef80a5cfb37282c6a53047783b4cc96d8daa4e3",
+        "2bc98db04ded8aa64af5d894f485173fbfad81976cbd0c6938de6910acfbd577",
         "387a3f7f7dfbde9823532435fc1c7dbca687c8f3d1b63d9a435812b4a33e0425",
         "3882bd338e65b9db9e97aa9e70426f0f7a0d191539df51636e1a5e93a2501137",
         "38a52af7c9d5f36e9e68553bf68a7d1ced9e9f9e6cecdf615efc122d42c8b89e",
@@ -1643,6 +1663,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "dd1aea1b9fdd0da023bf704b331b350bc14620f4364afa5001c6690fcbc940cc",
         "e3407d63eae16662923d46b75b6a41e7ca7ab206b428ea2cbb0b4fee226f6516",
         "e5070ad1408dcd30f1ec44d8c4b9b914a57a9930c0fc9345bd6f28941b52afe3",
+        "e987dd924dbbdc35eddf607a27372bfac6cf743c9ddb888d8a81b4b128c10908",
         "efd20725ffa4a613823084bc00f1ab584353f8d7ed1c11672b0a0193aefe658c",
     ]),
     "scripts/lisa-hooks/block-shell-json-parsing.sh": Object.freeze([
@@ -1723,6 +1744,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lisa-mutation.mjs": Object.freeze([
         "0cd013a51a81d8eeebced9f2646bdb3fe0a9247fcd74b57c03e95cc2db3fe7de",
         "0f5d9027e95d47745827adcd979e3c2355271066b6b84d661215dc6e895b3ac2",
+        "0fe73e162ece6c4a8270b0d5d675d6927a62962e0ae9275239c6acfacd0ef6c8",
         "19c77dd5ff81caf3ed92b5263b662bc16f9b43308993c6450cb6611bb037b180",
         "227dfa273802d6a5c03c3bf67136b743de98370127c7417db454f2e7424e98a0",
         "48394f771485db4b7863d2307f9ca0750cba4ce3750c615dd3c54fa47178a50e",